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(54) Method and system for advanced role-based access control in distributed and centralized 
computer systems 



(57) A method and system for registration, authori- 
zation, and control of access rights in a computer system 
are disclosed in the present invention. The inventive 
method for controlling access rights of subjects (1) on 
objects (4) in a computer system uses parameterized 
role types (2) that can be instantiated into role instances 
(4) equivalent to roles or groups as Known from the prior 
art The required parameters are provided by the subject 
(1) of the computer system, e.g. by a person (5). a job 
position (6) or an organization unit (7)- Furthermore, the 
inventive method provides relative resource sets (8) 
which are instantiated into concrete resource sets (9) 



and individual resources (10) by using the same param- 
eter values as for instantiating the role types. 

The inventive system for authorization and control 
of access rights as disdosed in the present invention 
comprises capability lists (30) providing the access 
"rights of the subjects (1 ) on the objects (4) of a computer 
system on a per-subject baas. Furthermore, the inven- 
tive system comprises means for deriving (32) access 
control lists (31) from capability lists (30), wherein said 
access rights of the subjects (1 ) on the respective objects 
(4) are provided- 
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Description 

TechntcaLFieTd 

The present invention relates to the technical field o 
of role-based access control methods and security sys- 
tems in distributed and centralized computer systems. 
More specifically, the invention relates to a method for 
controlling access rights of subjects on objects in a com- 
puter system by controlling said access rightsdependent ™ 
on a membership of a subject to a role. Furthermore, the 
invention relates to a system for registration, authoriza- 
tion, and control of access fights of subjects on objects 
in a computer system, wherein the system comprises 
users, groups, and access control lists at each object is 
providing the access rights on the respective object. 

Background Art 

In a computer system tine accesses of users to data 20 
have to be controlled for security needs of the enterprise 
or organization using this computer system. The control 
of these accesses is performed by using access rights 
defining whether and how a user may access data in the 
computer system. This access control is performed by a 2s 
security system which is integrated in or added to the 
operating system of the computer system. This security 
system performs a specific method for controlling access 
rlghts- 

In most of the installed computer systems access so 
rights are granted or revoked explicitly for individual 
users or group of users on respective data or, more gen- 
erally, on respective objects by a system administrator. 
All access rights of all users on this object ere forming 
an access control list (ACL) associated to this object 
When an access request occurs during operation time 
of the computer system from a user or, more generally, 
from a subject to this object, then the security system 
looks at the access control list of the respective object 
and decides whether the subject may access this object 
In the requested manner. These broadly Installed secu- 
rity systems allow a so-called "^r-object*evtew* T of 
access rights, that is. to determine the land of access 
rights of all subjects of a computer system to a respective 
object. 

Since it is very inconvenient for a system adminis- 
trator to provide each user with Individual access rights, 
and for achieving a higher grade of data security and 
integrity in a computer system, a Role-Based Access 
Control (RBAC) method has been developed. Therein, a 
role is mainly a definition of a job at the lowest level of 
granularity used in this enterprise or organization. In this 
role-based access control system the system adminis- 
trator only has to grant or revoke access rights to a role 
and has to group different subjects under this role. 

In F.hL Lochovsky: "Role-Based security fn Data 
Base Management systems" which is incorporated in 
G-EL Landwehr (editor): "Database Security: Status and 
Prospects", Elsevier Science Publishers B.V.. 1988. pp. 



209 - 222, the use of roles and objects in specifying a 
security mechanism for data base management syste ms 
is discussed. Using the idea that a user can play certain 
roles, authorization was specified using these roles. 

ln FLW. Baldwin: "Naming and Grouping Privileges 
to Simplify Security Management in Large Data Bases", 
Proceedings of IEEE Symposium on Security and Pri- 
vacy. Oakland, 1990, pp. 116 - 132, authorization and 
controlling access rights in large security systems in the 
field of data base objects are described. 

In D, Ferraiolo et at: "Role-Based Access Controls", 
Proceedings of the 5th National Computer Security Con- 
ference, Oct 1 992, pp. 554 - 563. which can be regarded 
as the closest prior art to the present invention, the role- 
based access control method is described in detail. 
Access control decisions are often based on the roles 
individual users take on as part of an organization. A role 
specifies a set of transactions that a user or set of users 
can perform within the context of an organization. Role- 
based access control provides a means of naming and 
describing relationships between individuals and access 
rights, providing a method of meeting the secure 
processing needs of many commercial and civilian gov- 
ernment organizations. 

Concerning the method of controlling access rights 
in a computer system as known from the existing rde- 
based access control methods it is disadvantageous that 
a large number of similar but not identical job positions 
in an organization requires a large number of roles. This 
large number of roles causes a high storage requirement 
for the security system within the computer system Fur- 
thermore it is disadvantageous, that the large number of 
roles causes high computing requirements for the secu- 
rity system. Both aspects lead to high costs for the oper- 
ation of the security system Fiirthertnore, It is 
disadvantageous that the large number of roles mates 
it very difficult to manage the security system. The sys- 
tem administrator has to create a new role when a person 
remains in his Job position but changes his location or 
project This will cause higher costs or even less system 
security. Furthermore, since a role includes the union of 
all accesses and objects which users of that role have in 
different organization units of the enterprise. This means 
that the role win not necessarily contain the least privi- 
leges necessary for the functions of that role, i.e., a vio- 
lation of the "Least Privilege Principle". However, if one 
attempts to mitigate the lack of access granularity with 
defining different roles based on access and object con- 
texts, which may be possfole in some designs, an admin- 
istrative mechanism becomes necessary to relate these 
rdes so trtattheir consistent e,g„ update, 

becomes possfrle* Such a mechanisms is not available 
today. 

Concerning the access control system it is disadvan- 
tageous, that the existing role-based access control sys- 
tems do not use the existing security mechanisms of the 
installed computer systems based on the existence of 
access control lists- Therefore, new security mecha- 
nisms or even a new security systems have to be impte- 
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merited on the existing computer system. This causes 
additional hardware and software development with 
related high costs. This is even more disadvantageous 
in distributed or large centralized computer systems. 
Existing standard access control mechanisms for distrib- 
uted systems as described in "Introduction toOSF DCE", 
Open Software Foundation (OSF). 1991. allow seal abil- 
ity to very large distributed systems. To date no role- 
based access control method scalable to large distrib- 
uted systems exists. 

Objects of tha Invention 

It is an object of the invention to provide a method 
for controlling access rights that is scalable to very large 
distributed computer systems and requires less storage 
and computing performance for the security system. Fur- 
thermore, it is an object of the invention to provide a role- 
based method for controlling access rights that does not 
necessarily violate the "Least Privilege Principle" but at 
the same time is more flexible and more convenient for 
the system administration. 

Concerning the system for authorization and control 
of access rights it is an object of the invention to provide 
a system that can use the security system of installed 
computer systems based on access control lists. 

Summary of the Invention 

The objects of the invention are fulf ffled by the fea- 
tures of independent claims 1 and 13. Further arrange- 
ments of the invention are disclosed in the according 
dependent claims. 

A method and system for registration, authorization, 
and control of access rights hi a computer system are 
disclosed in the present invention. The inventive method 
for controlling access rights of subjects on objects in a 
computer system uses parameterized role types that can 
be instantiated into role instances equivalent to notes as 
known from tie prior art. The required parameters are 
provided by the subject of the computer system, The 
computer system may derive the parameters from the 
job position of a subject or its membershp in an organi- 
zation unit. Furthermore, the inventive method provides 
relative resource sets which are instantiated into con- 
crete resource sets and individual resources by using the 
same parameter values as for instantiating of role types. 

The inventive system for authorization and control 
of access rights as disclosed in the present invention 
comprises capability Dsts providing the access rights of 
the subjects on the objects of a computer system on a 
per-subject basis, Furthermore, the inventive system 
comprises means for deriving access control lists from 
the capability lists, wherein the system provides said 
access rights of the subjects on the respective objects 
on a per-object basis. Within the inventive method, sub- 
jects are all possible types of holders of access rights 
within said computer system as for example persons, job 
positions, role instances, users, and transactions. Fur- 



thermore, objects are all possible types of resources on 
which access rights can be defined within the computer 
system as for example files, disks, displays, printers, 
scanners, and transactions, 

5 The invention as described in independent dairn 1 

eliminates the disadvantages previously described for 
the prior art A method for controlling access rights pro- 
viding role types that can be instantiated into rale 
instances offers the possibility to design a security sys- 

io tern for a computer system with very high flexibility- Since 
only a small number of role types has to be defined it is 
advantageous that less computing resources have to be 
provided for the security system within the computer sys- 
tem. Furthermore, it is advantageous that less adminis- 

is tratton activities caused by the definition of only a small 
number of role types requires less efforts, thus restricts 
the posstoiGty and probability of errors and confusion and 
therefore provides a higher system security Further- 
more, it is advantageous that by providing the appropri- 

20 ate parameter values the role instances of a role type 
can be restricted in such a way that the "Least Privilege 
Principle* is satisfied. Furthermore, it is advantageous 
that the automated generation of role instances by 
instantiating role types offers higher security of the com- 

2ff puter system and higher integrity of the data within the 
computer system. 

A role type combines a set of functional tasks with 
a common generic set of competences. A role type can 
be viewed as a template for defining the types of access 

30 rights, objects, and transactions necessary to carry put 
a set bf functional tasks. 

A role instance, on the other hand, defines the set 
fc of concrete and specific competences bound to a role 
type in a specific organization unit of the enterprise. An 

ss organization unit may be division, a department, a pro- 
gram, a project, a work-flow process or a combination 
thereot 

In one embodiment of the invention as descrfc>ed in 
claim 2 the rote type, is parameterized and the rale 

40 instance is generated by using at least one parameter 
value. The use of a parameterized role type allows more 
flexflbility of tie security system and less administration 
activities. Furthermore, it is advantageous that the use 
of parameterized role types requires less computing 

45 resources for the security system. 

In a further embodiment of the invention as 
described in claim 3 the objects of the computer systems 
are forming groups of concrete resource sets. Forming 
of such concrete resource sets is advantageous since it 

so allows to address functional groups of resources or 
objects with less computing efforts of the security system 
and less administrative overhead- 

In a further embodiment of the invention as 
descrbed in daim 4 the inventive method allows the 

55 automated derivation of the concrete resource sets from 
parameterized relative resource sets. This offers a 
higher flexibility of the security system with less admin- 
istration efforts- Furthermore, it is advantageous that 
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less computing resources are required for the security 
system. 

in a further embodiment of the invention as 
described in claim 5* the inventive method provides the 
parameter value for instantiating the parameterized role s 
types or the parameterized relative resource sets by the 
subjects of the computer system. This is advantageous 
since the derivation of role instances from role types or 
the derivation of concrete resource sets from relative 
resource sets can be fully automated and requires no to 
administration efforts. This restricts the possibility and 
probability of errors and confusion and therefore pro- 
vides a higher system security. 

In a further embodiment of the invention as 
described in claim 6 the parameter value is provided by is 
the Job position or by the organization unit. This is advan- 
tageous since ft provides a very flexible security system 
that requires very little administration activity when a per- 
son as a user of the computer systems changes its job 
position or even the organization unit. This requires less so 
efforts, thus restricts the possibility and probability of 
errors and confusion and therefore provides a higher 
System security. 

in a further embodiment of the Invention as 
described in claim 7 the job position is combined with at 25 
least one role type. This is advantageous since it allows 
the deriving of role instances associated with this role 
type by providing all necessary parameters for Instanti- 
ating a role type with this job position. This allows auto- 
mated derivation of role instances with no administration 3a 
activity and therefore requires less efforts, thus restricts 
the possibility and probability of errors and confusion and 
therefore provides a higher system security. 

In a further step of the invention as described in 
daim 8 the parameterized relative resource sets are 3s 
associated with the role types. This is advantageous 
since it allows automated derivation of the concrete 
resource sets and objects by the same parameters as 
provided for the role types. This allows automated deri- 
vation of the concrete resource sets with no admtnistra- 40 
tion activities and therefore requires less efforts, thus 
restricts the possfoifity and rxobability of errors and con- 
fusion and therefore provides a higher system security. 

In a further step of the invention as described in 
claim 9 the inventive method performs a configuration 4$ 
step for deriving the role instances and the concrete 
resource sets and objects. This automated configurating 
step is performed with each adrranistration action and 
provides at any time the actual and valid role instances 
and concrete resource sets and objects. This is advan- so 
tageous since it guarantees the efficiency of the security 
system and guarantees the security and integrity of data 
within the computer system. 

In a further embodiment of the invention as 
described in claim 10 the inventive method specifies ss 
capability list types associated with the rote types and 
performs an automated configurating step for deriving 
capability lists associated with rote instances. The capa- 
bility fists are instantiated from the capability list types by 



using the same parameters as for instantiating role types 
and these capability lists provide the access rights of the 
role instances on the objects within the computer sys- 
tem. The provision of capability lists within the security 
system of the computer system is advantageous, since 
it allows an automatic examination of the access rights 
of all subjects on alf possibly objects within the computer 
system without any administration activities and there- 
fore requires I ess efforts, thus res tri c ts the possibility and 
probability of errors and confusion and therefore pro- 
vides a higher system security. 

In a further ernbodtment of the invention as 
described in claim 1 1 the inventive method generates or 
modifies access control lists associated with the con- 
crete resource sets and objects. This is advantageous 
©nee it supports the security systems as known from the 
prior art and as used within a large number of installed 
computer systems with alt information required from 
these security systems. Therefore, the inventive method 
can be easily applied to the existing security systems 
without difficult modification or even expensive new 
implementation of the security system. In the case of 
scalable existing security systems for large distributed 
environments this method guarantees scalability of the 
role-based access control mechanism as well- 
In a further embodiment of the invention as 
described in claim 12 the role types are organized hier- 
archically. This is advantageous since it allows the 
organization of role types by subsuming relations. There- 
fore, if a first role type subsumes a second role type then 
the set of access rights available to an instance of the 
first role type includes those available to a corresponding 
instance of the second role type. This allows a very easy 
control of access rights with only tittle administration 
efforts. Furthermore, H is advantageous that the hienar- 
chal organization of role types requires (ess computing 
resources of the security system. 

With the invention related to a computer system for 
authorization and control of access rights es descrfaed 
in independent daim 13. the disadvantages previously 
described for the prior art are eliminated. The registra- 
tion, authorization, and control system presented jn this 
application offers the advantage that access control lists 
at the object as weft as capability lists at the subjects are 
provided. This aHows a fest review of the access rights 
of a subject on all possible objects with only fttie com- 
puting resources for the security system- Furthermore* 
it allows a quick review of all access rights of all possible 
subjects on a specific object with only Stile computing 
resources for the security system. Furthermore, it is 
advantageous that a system comprising access control 
Ests at the object as well as capability lists at the subject 
may be applied to all computer systems installed in the 
field without any change or new implementation in the 
operating system of the installed computer systems. Fur- 
thermore, the simultaneous existence of access control 
lists and capability lists offers high data security and 
integrity within the computer system. This is even more 
advantageous for large distributed computer systems. 
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In a further embodiment of the invention as 
descrfced in claim 14 the inventive system comprises 
means that derive the access control lists far the objects 
from the capability list at the subjects. The existence of 
this means is advantageous since it allows the automatic 
derivation of access control lists which are required from 
a large number of security systems of installed computer 
systems. Therefore, the inventive system can be easily 
applied to existing computer systems without any modi- 
fication of the security system of the installed computer 
systems. Furthermore* it is advantageous that this 
means derives the access control lisisautomatically and 
therefore a high data security and integrity within the 
computer system can be guaranteed. Furthermore, 
since the underlying access control mechanisms of 
existing security systems are used for access control 
checks at operation time, the inventive system does not 
lead to performance penalties and is scalable to the 
same degree as the underlying system. 

In a further embodiment of the invention as 
descrfaed in daim 15 the Inventive system comprises 
means for deriving the access control lists during a con- 
figuration step of the security system. This configurating 
step can be performed with or after each administration 
acton. This means offers the advantage that the access 
control lists are actualized with each administration 
action and therefore guarantees high data security and 
integrity within the computer system. Furthermore, this 
means is advantageous since it guarantees the data 
security and integrity with less computing resources for 
the security system and requires less efforts, thus 
restricts the possibility and probability of errors and con- 
fusion and therefore provides a higher system security. 

In a further embodimerit as described in claim 1 6 the 
inventive system comprises means for deriving the capa- 
bility lists from a role-based access control system. The 
presence of this means allows the application of rote- 
based access control systems as known from the prior 
art on security systems of computer systems as installed 
in thefieid in a large number. The inventive system allows 
advantageously the sppficafion of role-based access 
control systems without any modification or even new 
implementation on the installed security systems. There- 
fore, role-based access control systems can be provided 
for existing computer systems with low cost and high 
security and integrity of the data within the computer sys- 
tem. 

In a further embodiment of the invention as 
descrfoed in daim 17 the inventive system comprises 
means for deriving and generating user accounts from 
the capability list. This fe advantageous since it allows 
the automatic derivation and generation of user accounts 
on all computer systems that host objects occurring on 
the capability lists of subjects. This requires less efforts, 
thus restricts the possibility and probability of errors and 
confusion and therefore provides a higher system secu- 
rity. 



Brief Description of Jt he Drawings 

Fig- 1 gives an overview of the method for control- 
ling access rights. 

B 

Fig. 2A gives an overview of role type instantiation. 

Fig, 2B shows an example for role type instan^'ation. 

10 Fig. 2C shows the example of role type instantiation 
of Fig. 2B in more detail 



Fig. 3 A shows the aspect of rola type hierarchy of the 
inventive method. 

Fig. 3B shows an example of role type hierarchy for 
the business field of banking. 

Fig. 4 shows a method of resource set definition. 

Fig. 5 gives an overview of the method for control- 
ling access rights on organizational level as 
on system level. 
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25 Fig. 6 gives an overview of the system for authori- 
zation and control of access rights. 

Fig. 7 shows the possibility of a per-object-revlew 
as well as a per-sufcject-review as provided 
30 by the inventive system. 

Description of a Preferred Embodiment 

An elaborated preferred method for controlfing 

35 access rights of subjects on objects in a computer sys- 
tem and a preferred embodiment of a system for author- 
bring and control of access rights according to the 
present invention will be described with reference to the 
accompanying drawings. 

40 The Fig. 1 gives an overview of the method for con- 
trolling access rights. A set of subjects 1 as holders of 
access rights is defined and associated to a set of role 
types 2. The role types 2 are instantiated into a set of 
role instances 3 and therefore associates the subjects 1 

45 to the role instances 3. Multiple subjects 1 can be asso- 
datedwrthorte role type 2. Also, asubject 1 can be asso- 
ciated with more than one role type 2. The instantiation 
of role types 2 into roi e instances 3 also determines the 
association between the role instances 3 and the objects 

so 4 of the computer system. Usually there will be multiple 
instances of one role type due to different parameter val- 
ues provided by different subjects. 

The Fig. 2A gives an overview for the method of role 
type instantiation. Persons 5 that are users of an enter- 

55 ftfiseTOmputer system are e 

job positions a. Each Job position 6 is associated with a 
set of functional tasks and, thus, associates these tasks 
with a user in the enterprise organization hierarchy Each 
task requires a set of competences, which can be viewed 
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as a set of specific access rights to a set of objects 4 
necessary to carry out that task. Hence, each job posi- 
tion 6 ultimately associates a user with specif ic access 
rights to a set of objects 4. Thus, a security administrator 
must be able to associate these rights, objects, and 
transactions with the job positions of the enterprise 
organization. To enable this, the concepts of role types 
and role instances are defined. 

The Rg. 2B shows job positions 6. rote types 2. and 
the creation of role instances 3- The diagram shows an 
organization structure. e.g. organization units 7 and job 
positions 6. on the left and a set of role types 2 on the 
top Of the matrix An *X" in a field of the matrix means 
that a role instance 3 of the corresponding role type 2 is 
assigned to the job position 6, The necessary parameter 
values to instantiate the role type 2 are derived from 
attributes of the individual job position 6 or a higher level 
organization . unit. The values of these attributes deter- 
mine the actual competences the job position 6 is 
assigned via the role instance 3. Job positions 6 may 
share the same role instance 3 as illustrated by the 
shaded fields in a column. 

A job position 6 is associated with one or more role 
instances 3, depending upon how granular the job posi- 
tion 6 is intended to be. These role instances 3 are 
derived from different role types 2. For example, there 
are three role instances associated with the job position 
"staff member 2" of "private loans", one derived from the 
role type "loan specialist", another one derived from 
"customer consultant"*, and one derived from "bank 
employee". 

Often similar job positions, such as "staff member 1 " 
and **staff member 2" of the "private loans" department, 
will be assigned to the same role instance as shown from 
the shaded fields in the matrix, because none of the 
attributes that are relevant for instantiating the role type 
differ between the job positions. However, different job 
positions 6 or similar job positions 6 in different organi- 
zation units 7 will usually be associated with different role 
Instances 3 of the same role type 2, because they bring 
in different attribute values for the role type instantiation. 
In the above example the rde type loan specialist - is 
instantiated in two different role instances that are bound 
to two different job positions of the department "object 
appraisal", the leam-teader" and the "staff member 1 *" 
position. 

Job sharing can be modelled by assigning one job 
position 6 to multiple persons 5. On the other hand a sin- 
gle person 5 may be assigned to multiple job positions 
fx For example, a person 5 in a "staff member position 
in a department may also act, perhaps temporarily, as 
the "department manager". Of course, assignment to 
some job positions 6 may exdude assignment to other 
job positions 6 for separation-of-duty reasons. For exam- 
ple, a person 5 in the job position 6 "security administra- 
tor" may not be assigned to the Job position 6 of "auditor" 
because otherwise the ecxxKjrttability of the "security 
administrator's" actions would be lost 



The Fig. 2C shows an example of the role type 
instantiation method in more detail, especially for the role 
instance "m the framed matrix cell 15 of Rg. 2B. A role 
instance 3 binds the relative competences defined by a 

5 role type 2 to the objects 4. and access rights specific to 
an organization unit 7 or a job position G. To perform this, 
at first for each organization unit and for each job position 
6 a set of attributes has to be declared as relevant for 
role type instantiation. These attrfautss are said to be 

1 a advertised. As an example, this could be the department 
identity or the location attribute of the department organ- 
ization unit or the project identity attribute of a job position 
6. Second, so-called relative resource sets 8 may be 
defined and associated with role types 2. A relative 

75 resource set 8 specifies the parameters tt expects for 
instantiation from among the advertised ones in the 
enterprise- For example, one could define the relative 
resource set "printers" (printlocation) by enumerating the 
printers that are available to each location: 

sq printers (Boeblingen): - {p21 60, p2240, .»} 
printers (Heidelberg): = {prt01 , prt02, „.} 
The "Tprint location" parameter is declared as referencing 
the advertised "location" attribute of a department 
Thus, when a job position 6 as part of certain organ- 

2$ ization units 7 is combined with a role type 2 associated 
with parameterized relative resource sets 8, the actual 
resources can be determined by instantiating the param- 
eters with the values of the advertised attributes for this 
job position 6. In the example of Rg. 2C. if 

oa 

1. private loans is located in Heidelberg. 

2. the relative resource set 8 "printers ^0^003^00)" 
is associated with rote type 2 "band employee" wHh 

* permission "use", and 
35 3, "staff member 1 " of the department "private loans" 
is assigned the role type 2 "bank employee". 

Then "staff member t w will have "use" access to the 
printers "prt01 ¥ prt02, ..." . 
40 Whether a new role instance 3 has to be created in 
this case depends on whether the "bank employee" role 
type 2 has already been instantiated with the same 
parameters. If this is the case "staff member 1 " will only 
be assigned the already easting role instance 3 "bank 
45 employee (... , Heidelberg. ...)". 

Fig. 3A shows the role type hierarchy in the dis- 
closed inventive method. The access-control policy 
semantics captured by the specification of role types 
reflect the functional partitioning and inclusion of generic 
so access rights, resources, and transactions necessary to 
conduct the business activities and management of an 
enterprise. This partitioning and inclusion is intended to 
cover the data and application access relationships that 
are independent ol the users job position 6 and organi- 
se zation context, Le. units 7. of the enterprise. The rest of 
the access-control semantics captured by rde Instances 
3 and job positions 6 reflect constraints placed by enter- 
prise policies, such as the need-to4aiow and separation- 
of-duty policies, on enterprise organization units 7. 



6 



9Z9-d OtO/ElQd SOO-i 



2269BBW-BB-6W 



NNWfeiMIZ * addOHOS- NOA IV H 90-AON-H 



11 



£P 0 697 662 A1 



12 



A rote type 2 is defined as a set of generic parame- 
ter-dependent resources and their associated permis- 
sions or access rights, in a special case they may also 
contain concrete resources that do not depend on any 
parameters- Role types 2 can be organized hierarchically 
by a "subsumed" relation. If a first role type 1 6 subsumes 
a second role type 1 7 then the set of access rights avail- 
able to an instance 18 of the first role type 16 includes 
those available to a corresponding instance 19 of the 
second role type 17. The expression ^corresponding" in 
this context means that both role types 16. 17are instan- 
tiated with the same parameter values. The subsuming 
role type 16 must have at least the parameters of the 
subsumed rde type 17, it may have more. 

The role type hierarchy defines in mathematical 
terms a lattice structure. Trivially, the top of the lattice can 
include all types of access rights to all objects 4, whereas 
the bottom can include the respective empty sets. Of 
course* lattices wrth non-trivial tops and bottoms can be 
defined* When instantiating a lattice of role types in a sys- 
tem, the top and bottom of the lattice need not be used 
for any specific role instance 3 and job position 6. 

It is the implicit assumption which leads to the notion 
of the role type hierarchy that the sets of generic com- 
petences of job functions 6 and the role types 2 derived 
from them 

1 . can be structured as hierarchies by the subsumed 
relation, and 

2. do not change very frequentfy. 

The first assumption appears to be realistic because 
enterprise access control policies are often defined to 
reflect the hierarchical relationship built in an enterprise 
organization and functions. The second assumption also 
appeals to be realistic because the job functions defined 
with an enterprise are stabt e since they are based on the 
enterprise business characteristics. Since the definition 
of job functions does not change very often, the sets of 
access rights to objects 4 needed far a job position 6 are 
not expected to change very often. It is irrportant that 
neither assumption prevents the addition of new role 
types 2 to the lattice nor that of new role instances 3 and 
job positions 6 to an enterprise. 

The Rg. 3B shows an example for the role type hier- 
archy within the inventive method of access control. The 
example shows a hierarchy of the role types 2 used in 
Fig. 2B. In this example the access rights of a 'second- 
line manager and of a first-line manager* subsume 
those of a "secretary" which intern subsume those of a 
typist". All role types subsume the role type "bank 
employee*. As a consequence "bank employee" could 
be dropped from the matrix in Rg. 2B because the cor- 
responding competences are covered by a membership 
in any of the other role types. For the same reason the 
team-leader of the "object appraisal" department does 
not have to be assigned the •Joan specialist" role expGc- 
itiy since his team-leader role type subsumes it 



The Fig. 4 shows the instantiation of concrete 
resource sets 9 and individual resources 1 0 from param- 
eterized relative resource sets 8. The parameterized rel- 
ative resource sets 8 are associated to the 

5 parameterized role types 2, The concrete resource sets 
9 are derived from the parameterized relative resource 
sets S by using the parameter values provided from the 
subjects6. 7 in the computer systems, e.g. provided from 
the job positions 6 and organization units 7 of the enter- 

io prise. The individual resources 10 are grouped to con- 
crete resource sets 9. For example one possible 
parameterized relative resource sets is the resource set 
of 'printers" with a parameter "printlocation". By provid- 
ing the location parameter, for example location Heidel- 

75 berg, the relative resource set 8 is instantiated into the 
concrete resource set 9 that includes all printers at the 
location Heidelberg, These printers at the location Hei- 
delberg represent the Individual resources 10, 

The Fig. 5 shows an overview of the method for con- 

20 trolling access rights for the organizational level 20 as 
well as for the system level 21. It is shown that on the 
system level 21 persons 5 are represented as users 22. 
wherein one person 5 may have multiple user identifica- 
tions, which may bederived from the role information and 

25 automatically generated (automatic registration) in the 
same way as the access rights are derived (automatic 
authorization)- Furthermore, it is shown that the role 
instances 3 on the organization level 20 are represented 
by groups 23 on the system level. Furthermore, the con- 

30 crete resource sets 9 are represented by the individual 
resources 10 on the system level 21 . 

The Rg. 6 shows a preferred embodiment of a sys- 
tem for authorization and control of access rights as dis- 
"dosed in the present invention, it is shown that capability 

35 Iists30 associated to the subjects 1 of the computer sys- 
tem and containing the access rights of the respective 
subject 1 on the objects 4 of the computer system can 
be derived by appropriate means 32 into access control 
fists 31 associated to the objects 4 of the computer sys- 

40 tern and containing the access rights of the subjects 1 of 
the crjrnputer system on tie respective object 4. The der- 
ivation means 32 can be implemented by hardware or by 
software- Furthermore, it is also possible to derive capa- 
bility fists 30 from existing access control lists 31- 

45 The Fig. 7 shows the possibRrty to perform a per- 
object review 40 with the inventive system for authoriza- 
tion and control of access rights. In this example the 
access rights may be an execute permission "X", a read 
permission "FT or a write permission "W\ Since the 

$o inventive control system provides access control lists 31 
associated wfth the objects 4 of the computer system it 
is possible to evaluate these access control lists 31 in 
order to determine all access rights of groups 23 within 
the computer system on the respective object 4. The 

55 group 23 is the representation of an instance, Le. a role 
instance 3, of a parameterized role type 2. The role type 
2 is instantiated by at least one parameter value provided 
by the job position 6. The person 5 assigned to this job 
position 6 has at least one user identification. 
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As also shewn in Fig. 7. the inventive system for 
authorisation and control of access rights as disclosed 
in the present invention offers the possibility to perform 
a per-subject review 41. The job position 6 to which a 
person 5 is assigned to is associated with a role. Asso- 5 
dated to this role are the access rights of that role on the 
objects 4 of the computer system. The inventive system 
comprises capability lists 30 containing these access 
rights for each roie- Furthermore, the system comprises 
deriving means 32 to generate new or modify existing 70 
access control lists 31 from the capability lists 30. 

Claims 

1. A method for controlling access rights of at (east one is 
subject (1) on at least one object (4) in a computer 
system, wherein said subject (1) is associated to at 
least one role, sard method comprising the step of: 
controlling said access rights dependent on a mem- - 
bership of said subject (1 ) to said role, so 
characterized in that a role type {2} is provided and 
said role is represented as a role instance (3) and 
said method further comprising the prior step of: 
instantiating said role type (2) Into said role instance 
(3), that is f deriving said role instance (3) from said 25 
role type (2). 

Z. The method according to claim 1, wherein at least 
one parameter value is provided and said role type 
(2) is a parameterized role type (2), said method fur- so 
ther comprising the step of: 
instantiating said parameterized role type (2) by 
using said parameter value. 

3. The method according to claim 1 or 2, wherein at 35 
least one concrete resource set (9) is provided, said 
method further comprising the step of: 

providing said object (4) as an element of at least 
one of said concrete resource sets (9). 

40 

4. The method according to claim 3. wherein at least 
one parameter value is provided and at least one 
parameterized relative resource set (8) is provided, 
said method further comprising the step of: 
instantiating said parameterized relative resource 45 
set <8) into said concrete resource set (9) by using 
said parameter value, that is. deriving said concrete 
resource set (9) from said parameterized relative 
resource set (8) by using said parameter value. 

so 

5. The method according to one of claims 2 to 4. further 
comprising the step of: 

providing said parameter value by said subject (1). 

6. The method according to claim 5. wherein a job posi- 55 
ttan (6) within an organization unit (7) of the organi- 
zation of said subject (1) is provided, said method 
further comprising the step of: 
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providing said parameter value by said job position 
(6) or by said organization unit (7). 

7. The method of claim 6. further comprising the step 
of: 

combining said job position (6) with at least one of 
satd role types (2). 

8. The method of one of claims 4 to 7, further compris- 
ing the step of: 

associating at least one of said parameterized rela- 
tive resource sets (8} with said role types (2). 

9. The method of one of claims 3 to 8. further compris- 
ing the step of: 

performing a configurating step for deriving said role 
instances (3) and for deriving said concrete resource 
sets (9) and objects (4). 

10. The method of one of claims 3 to 9, further compris- 
ing the steps of: 

specifying capability list types associated with said 
role types (2). and 

performing a configurating step for deriving a capa- 
bility list (30) associated with a corresponding role 
instance (3) from said capability list types, said capa- 
bility list (30) provides said access rights of said role 
instance (3) on said objects (4). 

11. The method of claim 9 or 1 0, further comprising the 
step of: 

generating or rnodifying access control lists (31) 
associated with said concrete resource sets (9) and 
- objects (4). said access control lists (31) provide 
said access rights of said subjects (1) on said object 
(4). 

12. The method of one of daims 1 to 11. wherein 
said role types (2) are organized hierarchically 

13. A computer system for registration, authorization, 
and control of access rights of at least one subject 
(1) on at least one object (4). 

said system comprises access control lists (31) at 
each object (4), said access control lists (31 ) provide 
said access rights of said subjects (1) on said object 
(4). 

characterized in that, said system further comprises: 
capability lists (30) associated with said subject (1), 
said capabOity fists (30) provide said access rights 
of said subject (1) on said objects (4). 

14. The system according to claim 13, further compris- 
ing: 

means for deriving (32) said access control lists (31) 
at said objects (4) from said capability lists (30) asso- 
ciated with said subjects (1). 
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1 5. The system accord ing to claim 1 3 or 1 4. further com- 
prising: 

means for deriving (32) said access control lists (31) 
during a configurating step of said system. 

16. The system according to one of claims 13 to 15. fur- 
ther comprising; 

means for deriving (32) said capability lists (30) from 
a role based access control system, 

10 

1 7. The system according to one of claims 13 to 1 6, fur- 
ther comprising means for deriving and generating 
necessary user accounts from said capability lists 
(30) , in particular from the locations of objects (4) in 
said capability lists (30). is 
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